Windows Analysis Report
https://performancemanager10.successfactors.com/sf/hrisworkflowapprovelink?workflowRequestId=V4-0-a1-iHQRWD3bQis7XhhWNKzjfWwnvURbEsN0CxUc27Zt3ml0ag&company=oceanagoldT2&username=dave.oliver@oceanagold.com

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://performancemanager10.successfactors.com

{
    "risk_score": 6,
    "reasoning": "The script demonstrates a mix of behaviors, some of which raise moderate concerns. It collects and stores user login-related parameters in the browser's local storage, which could potentially be used for malicious purposes. Additionally, it modifies the 'href' attribute of various links on the page, potentially injecting additional parameters. While the script's intent appears to be related to login and authentication functionality, the way it handles sensitive data and modifies links warrants further review."
}

$(document).ready(function() {    localStorage.removeItem('loginRequestParams');    var buttons = "#forgotPasswordLink, #forgotPasswordLinkMobile, #registerLink, #registerLinkMobile";    var addParamToButtons = function(paramName, paramValue) {        $(buttons).each( function() {            var link = $(this);            var url = link.attr("href");            var paramString;            if (url && url.indexOf('?') >= 0) {                paramString = "&";            } else {                paramString = "?";            }            paramString += paramName + "=" + encodeURIComponent(paramValue);            link.attr("href", url + paramString);        });    };    if ($.ids) {            var targetUrl = $("#targetUrl").attr("value");            if ($.ids.overlay.getDestinationURI()) {                targetUrl = $.ids.overlay.getDestinationURI();            }            $("#targetUrl").attr("value", $.ids.overlay.getDestinationURI());        targetUrl = decodeURIComponent(targetUrl);        addParamToButtons("targetUrl", targetUrl);        var sourceUrl = $.ids.overlay.getParentURI();        $("#sourceUrl").attr("value", sourceUrl);        addParamToButtons("sourceUrl", sourceUrl);    } else {    }    var changeLink = $("#changeUserNameLink");    changeLink.click(function() {        $("#j_username").attr("disabled", "disabled");        $("#j_password").attr("disabled", "disabled");        $("#logOnForm").submit();    });    var loginRequestParams = {};    $('#logOnForm input[type="hidden"][value!=""]').each(function(index,input) {        loginRequestParams[input.name] = input.value;    });        var ssoType = "saml2";        loginRequestParams["ssoType"] = ssoType;    localStorage.setItem('loginRequestParams', JSON.stringify(loginRequestParams));});

{
  "contains_trigger_text": true,
  "trigger_text": "Sign In",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "Email or User Name",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "SAP"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "Email or User Name",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": true
}

{
  "brands": [
    "SAP"
  ]
}

```json{  "legit_domain": "sap.com",  "classification": "wellknown",  "reasons": [    "The brand 'SAP' is a well-known enterprise software company.",    "The URL 'anvu8lpeg.accounts.ondemand.com' uses a subdomain structure that is common for cloud services.",    "The domain 'ondemand.com' is associated with SAP's cloud services, which often use subdomains for different accounts or services.",    "The presence of input fields for 'Email or User Name' and 'Password' is typical for login pages, which is consistent with SAP's services.",    "No suspicious elements such as misspellings or unusual domain extensions were found in the URL."  ],  "riskscore": 2}

URL: anvu8lpeg.accounts.ondemand.com
			Brands: SAP
			Input Fields: Email or User Name, Password

```json{  "legit_domain": "sap.com",  "classification": "wellknown",  "reasons": [    "The brand 'SAP' is well-known and typically associated with the domain 'sap.com'.",    "The URL 'anvu8lpeg.accounts.ondemand.com' does not match the legitimate domain 'sap.com'.",    "The domain 'ondemand.com' is a generic domain and not directly associated with SAP.",    "The subdomain 'anvu8lpeg.accounts' is unusual and does not clearly indicate a legitimate SAP service.",    "The presence of input fields for 'Email or User Name' and 'Password' on a non-legitimate domain is a common phishing tactic."  ],  "riskscore": 8}
Google indexed: False

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "Email or User Name",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": true
}

{
  "brands": [
    "SAP"
  ]
}

```json{  "legit_domain": "sap.com",  "classification": "wellknown",  "reasons": [    "The brand 'SAP' is a well-known enterprise software company.",    "The URL 'anvu8lpeg.accounts.ondemand.com' uses a subdomain structure that is common for cloud services.",    "The domain 'ondemand.com' is associated with SAP's cloud services, which is legitimate.",    "The presence of 'accounts' in the subdomain suggests a login page, which aligns with the input fields provided.",    "No suspicious elements such as misspellings or unusual domain extensions were found in the URL."  ],  "riskscore": 2}

URL: anvu8lpeg.accounts.ondemand.com
			Brands: SAP
			Input Fields: Email or User Name, Password